nfsd: provide locking for v4_end_grace

[ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ]

Writing to v4_end_grace can race with server shutdown and result in
memory being accessed after it was freed - reclaim_str_hashtbl in
particularly.

We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is
held while client_tracking_op->init() is called and that can wait for
an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a
deadlock.

nfsd4_end_grace() is also called by the landromat work queue and this
doesn't require locking as server shutdown will stop the work and wait
for it before freeing anything that nfsd4_end_grace() might access.

However, we must be sure that writing to v4_end_grace doesn't restart
the work item after shutdown has already waited for it.  For this we
add a new flag protected with nn->client_lock.  It is set only while it
is safe to make client tracking calls, and v4_end_grace only schedules
work while the flag is set with the spinlock held.

So this patch adds a nfsd_net field "client_tracking_active" which is
set as described.  Another field "grace_end_forced", is set when
v4_end_grace is written.  After this is set, and providing
client_tracking_active is set, the laundromat is scheduled.
This "grace_end_forced" field bypasses other checks for whether the
grace period has finished.

This resolves a race which can result in use-after-free.

Reported-by: Li Lingfeng <lilingfeng3@huawei.com>
Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/T/#t
Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd")
Cc: stable@vger.kernel.org
Signed-off-by: NeilBrown <neil@brown.name>
Tested-by: Li Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
index 41c750f3447375e0cae4fe2a3afbb3aaca4c0fd4..be0c8f1ce4e3e8e4639e1fde88e9420c4125378d 100644 (file)
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -64,6 +64,8 @@ struct nfsd_net {
 
        struct lock_manager nfsd4_manager;
        bool grace_ended;
+       bool grace_end_forced;
+       bool client_tracking_active;
        time64_t boot_time;
 
        struct dentry *nfsd_client_dir;

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 58055ffc836a3c1131e0c7866aca4c540da0013d..86e3bf53440e38d4d03dc7c315822348d6e5c668 100644 (file)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -84,7 +84,7 @@ static u64 current_sessionid = 1;
 /* forward declarations */
 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
-void nfsd4_end_grace(struct nfsd_net *nn);
+static void nfsd4_end_grace(struct nfsd_net *nn);
 static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
 static void nfsd4_file_hash_remove(struct nfs4_file *fi);
 
@@ -5883,7 +5883,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
        return nfs_ok;
 }
 
-void
+static void
 nfsd4_end_grace(struct nfsd_net *nn)
 {
        /* do nothing if grace period already ended */
@@ -5916,6 +5916,33 @@ nfsd4_end_grace(struct nfsd_net *nn)
         */
 }
 
+/**
+ * nfsd4_force_end_grace - forcibly end the NFSv4 grace period
+ * @nn: network namespace for the server instance to be updated
+ *
+ * Forces bypass of normal grace period completion, then schedules
+ * the laundromat to end the grace period immediately. Does not wait
+ * for the grace period to fully terminate before returning.
+ *
+ * Return values:
+ *   %true: Grace termination schedule
+ *   %false: No action was taken
+ */
+bool nfsd4_force_end_grace(struct nfsd_net *nn)
+{
+       if (!nn->client_tracking_ops)
+               return false;
+       spin_lock(&nn->client_lock);
+       if (nn->grace_ended || !nn->client_tracking_active) {
+               spin_unlock(&nn->client_lock);
+               return false;
+       }
+       WRITE_ONCE(nn->grace_end_forced, true);
+       mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
+       spin_unlock(&nn->client_lock);
+       return true;
+}
+
 /*
  * If we've waited a lease period but there are still clients trying to
  * reclaim, wait a little longer to give them a chance to finish.
@@ -5925,6 +5952,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn)
        time64_t double_grace_period_end = nn->boot_time +
                                           2 * nn->nfsd4_lease;
 
+       if (READ_ONCE(nn->grace_end_forced))
+               return false;
        if (nn->track_reclaim_completes &&
                        atomic_read(&nn->nr_reclaim_complete) ==
                        nn->reclaim_str_hashtbl_size)
@@ -8132,6 +8161,8 @@ static int nfs4_state_create_net(struct net *net)
        nn->unconf_name_tree = RB_ROOT;
        nn->boot_time = ktime_get_real_seconds();
        nn->grace_ended = false;
+       nn->grace_end_forced = false;
+       nn->client_tracking_active = false;
        nn->nfsd4_manager.block_opens = true;
        INIT_LIST_HEAD(&nn->nfsd4_manager.list);
        INIT_LIST_HEAD(&nn->client_lru);
@@ -8208,6 +8239,10 @@ nfs4_state_start_net(struct net *net)
                return ret;
        locks_start_grace(net, &nn->nfsd4_manager);
        nfsd4_client_tracking_init(net);
+       /* safe for laundromat to run now */
+       spin_lock(&nn->client_lock);
+       nn->client_tracking_active = true;
+       spin_unlock(&nn->client_lock);
        if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
                goto skip_grace;
        printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
@@ -8254,6 +8289,9 @@ nfs4_state_shutdown_net(struct net *net)
 
        unregister_shrinker(&nn->nfsd_client_shrinker);
        cancel_work_sync(&nn->nfsd_shrinker_work);
+       spin_lock(&nn->client_lock);
+       nn->client_tracking_active = false;
+       spin_unlock(&nn->client_lock);
        cancel_delayed_work_sync(&nn->laundromat_work);
        locks_end_grace(&nn->nfsd4_manager);
 

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 2feaa49fb9fe25fc95448b1c2132eb42b0be4ec3..07e5b1b23c91faeee9ef16b7c4750fed1f849f4f 100644 (file)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1117,9 +1117,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
                case 'Y':
                case 'y':
                case '1':
-                       if (!nn->nfsd_serv)
+                       if (!nfsd4_force_end_grace(nn))
                                return -EBUSY;
-                       nfsd4_end_grace(nn);
                        break;
                default:
                        return -EINVAL;

diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index e94634d3059127f2ca9f385ced1bd694b98ad501..477828dbfc665df0030c7bb98e3db042f38dc985 100644 (file)
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -719,7 +719,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi)
 struct nfsd_file *find_any_file(struct nfs4_file *f);
 
 /* grace period management */
-void nfsd4_end_grace(struct nfsd_net *nn);
+bool nfsd4_force_end_grace(struct nfsd_net *nn);
 
 /* nfs4recover operations */
 extern int nfsd4_client_tracking_init(struct net *net);